All postsEvery form on an Atlas site can now defend itself. Atlas Shield is spam protection built into the Atlas API: bots that post straight to your forms are turned away, suspicious leads are held for review instead of reaching your CRM, and your ad platforms stop learning from fake conversions.
Why we built it
A lead form is a public door. Until now the only lock was a per address rate limit, which a bot that rotates addresses walks straight past. Every fake lead was stored, sent to the CRM, reported to Meta and TikTok as a Lead conversion and announced to your team. The cost is not the inbox: it is the ad algorithm optimising for bots.
How Atlas Shield works
- A signed, single use challenge. Before a form is sent, the browser asks Atlas for a challenge token. It is signed for your brand and that one form, it expires, and it works once. A bot that posts straight to the API has none, and a copied token cannot be replayed.
- Invisible proof of work. The browser solves a small puzzle while the visitor types. People never notice it; a bot pays for every single send.
- A time trap. A form filled and sent in under a few seconds is not a person.
- Content rules. Too many links, HTML in a field or the same message sent again within minutes are flagged.
- Captcha when you want it. Turn on Cloudflare Turnstile or hCaptcha for any form. Turnstile managed, non-interactive and invisible widgets are all supported, and so is invisible hCaptcha. Atlas checks every token itself, including that it was solved on your own domain for that form.
Spam is held, never lost
A lead that looks suspicious is not thrown away. It is stored as spam with the reasons next to it, kept out of the CRM, out of conversion tracking and out of notifications. If a real person was caught, one click on Not spam sends the lead on as if nothing happened. If a captcha provider has an outage, leads are held for review too, so you never lose a customer to someone else's downtime.
You decide how strict
Atlas Shield has three modes: Off, Monitor (every lead is taken and the reasons are only noted, ideal while you roll it out) and Enforce. Set a default for the whole brand in Settings, Forms, give a single form its own settings, or change them right on the form block in the visual builder. The minimum time, the proof of work level, the links allowed and the duplicate window are all yours to tune.
Do I need to do anything?
Sites that use the Atlas form block answer the challenge on their own once they run the latest layer. Brands that already take leads start in Monitor, so nothing breaks while you look at the reasons; switch to Enforce when you are happy. For a captcha, add your Turnstile or hCaptcha keys under Integrations, Security and pick it for your forms. The details are in the docs.
